OK so thankfully I kept on reading about malware etc and came across a video on youtube talking about ZeroAccess. I checked into some of the things he was pointing out as symptoms and sure enough I have them, but I have not seen anything in Sysinternals proc explorer or in my network activity.
I had ZeroAccess on my system maybe a week ago when I opened a "crack" (I'm a dumbass honestly, I should know better) and since AVG could not handle it I went to the forums and found someone suggesting to use RogueKiller and HitmanPro. I used those in conjunction and they both seemed to deal with the threat, I was able to "replace" the infect svchost.exe and basically every single symptom that I noticed was gone at the time. I ran scans with malwarebytes, Avast, hitmanpro, as well as an Avast boot scan which all came back clean. Since then I've been doing everything sandboxed. I also looked into things with Sysinternals Process Explorer and found absolutely nothing suspicious.
What I did just recently was I ran TDSS Killer, had to do it a couple times with different options and I got different results... but it found things. So I followed along to remove or quarantine and then rebooted. After reboot, Sysinternals proc explorer does not work (got it to work in Sandboxie tho) and a lot of very suspicious things started happening. Something changed slightly with the TDSSKiller scan and I can tell it's being faked (specifically it appears to skip over the drivers in %windir%/system32/drivers).
Surprisingly Autoruns works just fine without any virualization trickery, and looking in there I see many suspicious items. I'm going to try to disable just the ones that I am very confident wont break my computer and see what happens. Other than that please advise.
Thank you guys ....
